Agile Defense

Cybersecurity and IT services for government

Zscaler Solutions Architect SME

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timeAshburn, VA, USA$170k - $185k /yr

About the Job

Requirements

A minimum of 10 years of relevant experience is required.
Strong hands-on experience with Zscaler Internet Access (ZIA), including security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting.
Strong hands-on experience with Zscaler Private Access (ZPA), including App Connectors, application segments, access policies, private application connectivity, and troubleshooting.
Strong hands-on experience with Zscaler Client Connector (ZCC), including deployment, configuration, forwarding profiles, upgrades, endpoint compatibility, and troubleshooting.
Strong hands-on experience with Zscaler Digital Experience (ZDX), including application performance monitoring, network path analysis, latency investigation, and troubleshooting.
Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements.
PowerShell scripting and automation for troubleshooting and operational support.
Strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis.
Ability to independently diagnose complex connectivity, authentication, application performance, and security policy issues; coordinate with other technical teams; and document root causes and corrective actions.
Must be able to pass a CBP background investigation.
Ability to travel within the United States on short notice or as scheduled, up to 20% of the time.

Responsibilities

Design, implement, and maintain enterprise Zscaler deployments (ZIA, ZPA, ZDX, and Zscaler Client Connector) across multi-cloud and hybrid corporate environments.
Create, audit, and tune security policies, including URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, Data Loss Prevention (DLP), and sandbox policies.
Formulate and execute ZPA access policies to enable least-privilege direct access to internal applications in private clouds (AWS, Azure, and GCP) and on-premises data centers without traditional VPN overhead.
Provide Tier 3/Tier 4 escalation support for complex proxy routing, PAC file debugging, identity integration, authentication drops, and application latency issues.
Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector across macOS, Windows, iOS, and Android platforms.
Use ZDX and cloud analytics to isolate user experience degradation across endpoint, network ISP, and application levels; configure automated alerting and SIEM log integration with Splunk and Cribl.
Partner with Identity and Access Management (IAM) teams to configure SAML/SCIM attributes with identity providers such as Okta, Microsoft Entra ID (Azure AD), or Ping Identity.
Provide Tier 2/Tier 3 escalation support for network outages, circuit degradations, and performance issues; conduct root cause analyses and coordinate vendor support.
Maintain accurate network diagrams using Visio, topology maps, inventory databases, standard operating procedures, and change control tickets using ServiceNow or Remedy.
Support readiness for a 24/7/365 on-call rotation and respond to Tier 3 critical network incidents within service-level agreement limits, coordinating cross-functional escalation pathways.
When needed to restore services, develop a solution and implement an Emergency Change Request, Emergency Break Fix, or Change Request.
Participate in root cause analysis or post-incident analysis of problems involving mission-critical applications, mission-essential applications, mission-essential network infrastructure, and recurring enterprise IT infrastructure issues.
Partner with program and project managers to align network engineering deliverables, milestone schedules, and resource planning with enterprise project objectives.

Desired Qualifications

Zscaler ZIA administration certification or equivalent official training.
Zscaler ZPA administration certification or equivalent official training.
Zscaler ZDX training or relevant certification, where available.
Cisco CCNA or CCNP certification.
CompTIA Security+ certification.
Relevant Zscaler Zero Trust or advanced security training.
Experience investigating Zscaler-related connectivity, authentication, performance, and security policy issues involving Splunk, Cribl, CrowdStrike, and Okta.
Experience with AWS and Microsoft Azure cloud platforms.
Experience with GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs, and other enterprise development platforms.
Familiarity with mobile devices, mobile applications, wireless connectivity, VPN interactions, and mobile device management solutions.
Experience troubleshooting connectivity and security for ZSIM-related applications and infrastructure.
Experience with network connectivity, remote access, streaming, and security policy compatibility for WCTTV camera systems.
Experience with connectivity and application access requirements associated with drone platforms, management software, and supporting services.

Salary Range: 170000 to 185000 (Currency: USD) (Pay period: per-year-salary)

Serve as a Zscaler Solutions Architect SME enabling the Department of Homeland Security (DHS) mission and enterprise network infrastructure. The applicant will serve as the primary technical authority for designing, deploying, administering, upgrading and optimizing enterprise-wide Secure Access Service Edge (SASE) solutions using the Zscaler cloud security platform. This role leads the operational architecture across Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX), driving modern Zero Trust initiatives

The Zscaler Solutions Architect SME will be the technical lead performing the following:
Architecture & Engineering: Design, implement, and maintain enterprise Zscaler deployments (ZIA, ZPA, ZDX, and Zscaler Client Connector) across multi-cloud and hybrid corporate environments.
Policy & Governance: Create, audit, and tune security policies, including URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, Data Loss Prevention (DLP), and sandbox policies.
Zero Trust Deployment: Formulate and execute access policies within ZPA to enable least-privilege direct access to internal applications in private clouds (AWS, Azure, GCP) and on-premises data centers without traditional VPN overhead.
Operational Troubleshooting: Serve as Tier-3/Tier-4 escalation support for complex proxy routing, PAC (Proxy Auto-Configuration) file debugging, identity integration, authentication drops, and application latency issues.
Agent Lifecycle Management: Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector (ZCC) across macOS, Windows, iOS, and Android platforms.
Observability & Analytics: Leverage ZDX and cloud analytics to isolate user experience degradation across endpoint, network ISP, and application levels; configure automated alerting and SIEM log integration (Splunk, Cribl).
Cross-Functional Integration: Partner with Identity and Access Management (IAM) teams to configure SAML/SCIM attributes with IdPs such as Okta, Microsoft Entra ID (Azure AD), or Ping Identity.
Troubleshooting & Incident Management: Provide Tier 2/Tier 3 escalation support for network outages, circuit degradations, and performance issues; conduct root cause analyses (RCA) and coordinate vendor support.
Documentation & Asset Management: Maintain accurate network diagrams (Visio), topology maps, inventory databases, standard operating procedures (SOPs), and change control tickets (ServiceNow/Remedy).
Support On-Call & Escalation Management: support 24/7/365 on-call rotation readiness to respond to Tier 3 critical network incidents within SLA limits and coordinating cross-functional escalation pathways. When needed to restore services, the Senior Network Engineer will provide a solution and implement an Emergency Change Request (ECR), Emergency Break Fix (EBF), or Change Request.
Root Cause Analysis (RCA) or Post Incident Reporting: Participate in the Root Cause Analysis (RCA) or post incident analysis of problems for mission critical applications, mission essential applications, and mission essential network infrastructure as well as recurring issues on the enterprise IT infrastructure.
Project Support: Partner with program and project managers to align network engineering deliverables, milestone schedules, and resource planning with enterprise project objectives.
Excellent problem-solving and analytical skills, with the ability to troubleshoot complex network issues.
Scheduled and Adhoc Travel: Ability to travel within the United States either on short notice or scheduled, up to 20% of the time.

Required

1. Must have a minimum of 10+ years of relevant experience

The candidate should have strong hands-on experience with:

Zscaler Internet Access (ZIA): Security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting.
Zscaler Private Access (ZPA): App Connectors, application segments, access policies, private application connectivity, and troubleshooting.
Zscaler Client Connector (ZCC): Deployment, configuration, forwarding profiles, upgrades, endpoint compatibility, and troubleshooting.
Zscaler Digital Experience (ZDX): Application performance monitoring, network path analysis, latency investigation, and troubleshooting.
PAC Files: Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements.
PowerShell: Scripting and automation for troubleshooting and operational support.

2. Enterprise Networking and Advanced Troubleshooting

The ideal candidate should have strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis.

The SME should be able to independently diagnose complex connectivity, authentication, application performance, and security policy issues; coordinate with other technical teams; and document root causes and corrective actions.

Certifications

Zscaler ZIA administration certification or equivalent official training.
Zscaler ZPA administration certification or equivalent official training.
Zscaler ZDX training or relevant certification, where available.
Cisco CCNA or CCNP.
CompTIA Security+.
Relevant Zscaler Zero Trust or advanced security training.

MUST BE ABLE TO PASS A CBP BI

Nice to Have

Enterprise Applications and Technology Integration – Highly Desirable

Our environment includes a wide range of enterprise technologies and specialized applications. The SME should be comfortable investigating Zscaler-related connectivity, authentication, performance, and security policy issues involving:

Security and monitoring: Splunk, Cribl, CrowdStrike, and Okta.

Cloud platforms: AWS and Microsoft Azure.

Developer tools: GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs, and other enterprise development platforms.

Mobile technologies: Mobile devices, mobile applications, wireless connectivity, VPN interactions, and mobile device management solutions.

ZSIM: Connectivity and security troubleshooting involving ZSIM-related applications and infrastructure.

WCTTV camera systems: Network connectivity, remote access, streaming, and security policy compatibility for camera-related services.

Drone technologies: Connectivity and application access requirements associated with drone-related platforms, management software, and supporting services.

About the Company

Agile Defense

Cybersecurity and IT services for government

Agile Defense provides IT and cybersecurity services to the U.S. Federal Government, including digital transformation, IT modernization, and a Virtual Security Operations Center (VSOC) to defend against cyber threats. Its services support national security and civilian missions across federal agencies, delivered through various contract vehicles. The company expands its capabilities through acquisitions (IntelliBridge and XOR Security) and focuses on AI-enabled workforce transformation and enterprise IT to enhance government operations. Unlike many suppliers, Agile Defense emphasizes a government-focused portfolio with a multidimensional VSOC and AI-driven workforce upgrades, positioning itself to meet federal security and modernization needs. The goal is to help federal agencies protect data and systems, modernize IT infrastructure, and improve cyber resilience across national security and civilian missions.

Company size: 1,001-5,000
Company stage: Acquired
Total funding: Not listed
Headquarters: Reston, VA
Founded: 1998

Recently Posted Jobs

Explore more opportunities at Agile Defense

See more jobs